Repository navigation
ci(security): monthly Snyk comparison against a triaged baseline - #741
Merged
Merged
Conversation
Runs Snyk Open Source (pnpm workspaces, Android release/sideload runtime) and Snyk Code on the 1st of each month. scripts/snyk-monthly.mjs compares the results with security/snyk-baseline.json by Snyk finding identity and opens or updates one issue for anything new. Never blocks a PR. Needs a SNYK_TOKEN repository secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…ts test Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follows the Snyk trial (#740).
.github/workflows/snyk-monthly.yml: on the 1st of each month (09:17 KST) and on demand, runs Snyk Open Source on the pnpm workspaces and the Android release/sideload runtime, plus Snyk Code. Snyk CLI pinned to 1.1308.4. Not a PR check.scripts/snyk-monthly.mjs: compares the results withsecurity/snyk-baseline.jsonby Snyk finding identity, or the exact-content hash as a fallback. Only new findings open or update oneSnyk monthly:issue. Malformed or failed Snyk output is an error; it is never read as zero findings.security/snyk-baseline.json: today's master scan, 339 findings. Each of the 23 error-level code findings carries its reviewed reason. Warnings and notes are markedrecorded, not individually reviewed. Comparing today's scan against it reports 0 new findings.Needs: a
SNYK_TOKENrepository secret. Without it the run fails with a clear message.Checks: 5 new unit tests;
pnpm verify:quickpasses, including the catalog and Korean-locale coverage tests. The three scans were run locally with the exact workflow flags.🤖 Generated with Claude Code